Sorry for my poor english.

In samba3.0.0/2.2.8a smbd/trans2.c, potentially NULL pointer reference when 
CIFS-client printer-ioctl(?) request with invalid fid. 
file_fsp() can return NULL, and refer fsp->rap_print_jobid unless fsp NULL-
check.

To fix, probably add below code.
-------------------------------------------------
  files_struct *fsp = file_fsp(inbuf,smb_vwv15);
+ if (!fsp) {                                   
+   return(UNIXERROR(ERRDOS,ERRbadfid));  
+ }                                             
-------------------------------------------------

-----------------------------------------------------------------------
static int call_trans2ioctl(connection_struct *conn, char* inbuf,
          char* outbuf, int length, int bufsize,
          char **pparams, int total_params, char **ppdata, int total_data)
{
  char *pdata = *ppdata;
  files_struct *fsp = file_fsp(inbuf,smb_vwv15);
                ^^^^^^^^^^^^^^
  if ((SVAL(inbuf,(smb_setup+4)) == LMCAT_SPL) &&
      (SVAL(inbuf,(smb_setup+6)) == LMFUNC_GETJOBID)) {
    pdata = Realloc(*ppdata, 32);
    if(pdata == NULL)
      return ERROR_DOS(ERRDOS,ERRnomem);
    *ppdata = pdata;

    /* NOTE - THIS IS ASCII ONLY AT THE MOMENT - NOT SURE IF OS/2
      CAN ACCEPT THIS IN UNICODE. JRA. */

    SSVAL(pdata,0,fsp->rap_print_jobid);  /* Job number */
                  ^^^^^^^^^^^^^^^^^^^^^
    (snip)
  } else {
    (snip)
  }
}
-----------------------------------------------------------------------